Service accounts for applications in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a service account using gcloud CLI.

GCP

gcloud iam service-accounts create [1] --display-name="My App Service Account"

Drag options to blanks, or click blank then click option'

Amy-app-sa

Bdefault

Cadmin-user

Dcompute-engine

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default' which is reserved for default service accounts.

Using names unrelated to the application.

The command creates a new service account named my-app-sa. This name is unique and descriptive for the application.

2fill in blank

medium

Complete the code to assign the 'roles/storage.objectViewer' role to the service account.

GCP

gcloud projects add-iam-policy-binding my-project --member="serviceAccount:[1]@my-project.iam.gserviceaccount.com" --role="roles/storage.objectViewer"

Drag options to blanks, or click blank then click option'

Acompute-engine

Bmy-app-sa

Cadmin-user

Ddefault

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default' or other service accounts not related to the application.

Incorrect member format.

The service account my-app-sa is granted the role to view storage objects, which is a common permission for applications accessing Cloud Storage.

3fill in blank

hard

Fix the error in the command to activate the service account key file.

GCP

gcloud auth activate-service-account [1] --key-file=key.json

Drag options to blanks, or click blank then click option'

[e-mail]

Bmy-app-sa

Cdefault

[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using only the service account name without the project domain.

Using unrelated service account emails.

The full email of the service account must be used to activate it, not just the name.

4fill in blank

hard

Fill both blanks to create a JSON key for the service account and save it to a file.

GCP

gcloud iam service-accounts keys create [1] --iam-account=[2]

Drag options to blanks, or click blank then click option'

Akey.json

[e-mail]

[e-mail]

Dcredentials.json

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong file names that don't match the key file.

Using incorrect service account emails.

The key file is saved as key.json and is created for the correct service account email.

5fill in blank

hard

Fill all three blanks to set the environment variable for application authentication.

GCP

export GOOGLE_APPLICATION_CREDENTIALS=[1] && gcloud auth activate-service-account [2] --key-file=[3]

Drag options to blanks, or click blank then click option'

Akey.json

[e-mail]

Dcredentials.json

Attempts:

3 left

💡 Hint

Common Mistakes

Using different file names for the environment variable and activation.

Using incomplete service account names.

The environment variable points to the key file key.json, and the service account is activated using the same key file and full email.